Does Uruguay have a national PQC commitment?

Yes. Uruguay's National Cybersecurity Strategy 2024-2030, published by AGESIC, names post-quantum cryptography in two separate action lines: identifying critical-infrastructure operators' post-quantum needs and developing a transition plan, and building a new national public-key infrastructure resistant to quantum-technology threats.

Does Uruguay's strategy set a PQC migration deadline?

No. Neither action line carries its own target year. Both are framed as government-led planning and infrastructure-building commitments within the strategy's overall 2024-2030 window, without a specific date for either the transition plan or the new PKI.

Has Uruguay's central bank published PQC guidance?

No. Neither Banco Central del Uruguay nor URSEC, Uruguay's telecom regulator, has published a PQC-specific circular or supervisory guidance of its own.

Does Uruguay require a cryptographic inventory?

Not explicitly. No cryptographic-inventory or CBOM requirement is named anywhere in the strategy, though identifying critical-infrastructure operators' post-quantum needs would, in practice, require knowing what cryptography those operators currently run.

pqcuruguayagesicpkinational-strategy

Uruguay Committed to Building Quantum-Resistant National PKI. It Didn't Commit to a Year.

Two real, specific actions in Uruguay's National Cybersecurity Strategy name post-quantum cryptography directly -- including a new national public-key infrastructure. Neither one has a date attached.

PQC Security EditorialOctober 18, 20263 min read

Most national PQC commitments are about fixing what already exists -- migrate this algorithm, inventory that system. Uruguay's strategy does something rarer: it commits to building new infrastructure designed to be quantum-resistant from the start. It just doesn't say when.

Two commitments, both real, neither dated

Uruguay's National Cybersecurity Strategy 2024-2030, published by AGESIC (Agencia de Gobierno Electrónico y Sociedad de la Información y del Conocimiento), names post-quantum cryptography directly in two separate action lines. The first, under "Línea 5.2" (strengthening critical information infrastructure):

"Identificar las necesidades de las IIC respecto de la criptografía poscuántica y desarrollar un plan de transición." ("Identify critical information infrastructure operators' needs regarding post-quantum cryptography and develop a transition plan.")

That's a government commitment to assess and plan -- real, but directionally similar to what several other countries' early-stage strategies commit to. The second action, under "Línea 5.3" (strengthening critical infrastructure's digital resilience), is more unusual:

"Desarrollar una nueva infraestructura de clave pública nacional, alineada con los estándares internacionales y resistente a las amenazas de la tecnología cuántica, a través de la colaboración público-privada y la adopción de algoritmos criptográficos poscuánticos." ("Develop a new national public-key infrastructure, aligned with international standards and resistant to quantum-technology threats, through public-private collaboration and the adoption of post-quantum cryptographic algorithms.")

That's a commitment to build something new, designed for quantum resistance from the outset, rather than migrate an existing system. Most PQC guidance on this tracker is retrofit-oriented -- find your current RSA and ECC deployments, replace them. Uruguay's second action line is closer to Vietnam's "Make in Vietnam" cryptographic-ecosystem objective or Ukraine's independently-developed national algorithm: a forward-looking infrastructure project rather than a migration checklist.

What's missing from both

Here's the gap: neither action carries its own target year. The strategy runs through 2030 as a whole, but nothing in the text we could verify ties either the transition plan or the new PKI to a specific date within that window. No penalty, no reporting mechanism, no interim milestone for either commitment -- both are framed as government-led planning and infrastructure work, not obligations on any regulated entity.

That combination -- genuinely specific about what (a new, quantum-resistant national PKI, developed through public-private collaboration, naming post-quantum algorithms directly) and genuinely vague about when -- is distinctive even among guidance-stage countries on this tracker. Most vague commitments are vague about both the what and the when. Uruguay knows what it's building and hasn't said by when.

The regulators that haven't weighed in

Neither Banco Central del Uruguay nor URSEC, Uruguay's telecom regulator, has published PQC-specific guidance of its own. That means the national strategy's commitments currently exist without a sector regulator positioned to make them binding for any specific industry -- a pattern similar to Luxembourg's CSSF gap, though Uruguay's strategy itself is more PQC-specific than Luxembourg's.

What to do with this

If you operate critical infrastructure in Uruguay, or work with AGESIC on the forthcoming transition plan, the new national PKI commitment is worth watching closely -- a quantum-resistant PKI built from scratch, rather than retrofitted, is a different kind of technical project than most organizations are planning for elsewhere, and public-private collaboration language suggests industry input will shape its design. Without a stated deadline, the practical move is to engage with AGESIC's planning process directly rather than wait for a compliance date that hasn't been set yet.

The Uruguay country page tracks both commitments with their primary source.

Frequently asked questions

Does Uruguay have a national PQC commitment?: Yes. Uruguay's National Cybersecurity Strategy 2024-2030, published by AGESIC, names post-quantum cryptography in two separate action lines: identifying critical-infrastructure operators' post-quantum needs and developing a transition plan, and building a new national public-key infrastructure resistant to quantum-technology threats.
Does Uruguay's strategy set a PQC migration deadline?: No. Neither action line carries its own target year. Both are framed as government-led planning and infrastructure-building commitments within the strategy's overall 2024-2030 window, without a specific date for either the transition plan or the new PKI.
What is Uruguay's new national PKI commitment?: A specific infrastructure project: "Develop a new national public-key infrastructure, aligned with international standards and resistant to quantum-technology threats, through public-private collaboration and the adoption of post-quantum cryptographic algorithms." This is more concrete than most countries' PQC guidance, which typically addresses existing systems rather than committing to build new infrastructure designed for quantum resistance from the outset.
Has Uruguay's central bank published PQC guidance?: No. Neither Banco Central del Uruguay nor URSEC, Uruguay's telecom regulator, has published a PQC-specific circular or supervisory guidance of its own.
Does Uruguay require a cryptographic inventory?: Not explicitly. No cryptographic-inventory or CBOM requirement is named anywhere in the strategy, though identifying critical-infrastructure operators' post-quantum needs would, in practice, require knowing what cryptography those operators currently run.